What is the CVSS score of CVE-2026-46587?

CVE-2026-46587 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Apache Camel are affected by CVE-2026-46587?

Apache Camel, a widely-deployed Java integration framework, contains an information disclosure vulnerability affecting versions through 4.14.7, 4.15.0-4.18.2, and 4.19.0-4.20.0.. A patch is available.

How to fix or mitigate CVE-2026-46587?

24 hours: Enumerate all systems running Apache Camel and document installed versions. 7 days: Implement network-level input filtering and strengthen application-layer input validation on all Camel endpoints; apply WAF rules for malformed request detection if infrastructure supports it. 30 days: Monitor Apache's official security advisories for patch availability; develop and test upgrade path to patched version when released.

Apache Camel CVE-2026-46587

EUVD-2026-41865 HIGH

Improper Input Validation (CWE-20)

2026-07-06 apache

GHSA-46jf-c9vx-hh79

Information Disclosure Apache Apache Camel

7.3

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

7.3 HIGH

Vendor-assigned network, unauthenticated, low-complexity path with bounded Low impact retained absent any description detail contradicting AV:N/PR:N, though component specifics are unverifiable.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Updated

Jul 06, 2026 - 19:39 vuln.today

v3 (cvss_changed)

Analysis Updated

Jul 06, 2026 - 19:38 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 06, 2026 - 19:22 vuln.today

cvss_changed

CVSS changed

Jul 06, 2026 - 19:22 NVD

7.3 (HIGH)

Analysis Generated

Jul 06, 2026 - 11:00 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

11 maven packages depend on org.apache.camel:camel-couchbase (5 direct, 6 indirect)

Ecosystem-wide dependent count for version 4.0.0.

DescriptionCVE.org

Improper Input Validation vulnerability in Apache Camel.

This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20.0.

Users are recommended to upgrade to version 4.14.8, 4.18.3, 4.21.0, which fixes the issue.

AnalysisAI

Improper input validation in Apache Camel - the open-source Java integration framework - affects versions through 4.14.7, 4.15.0 through 4.18.2, and 4.19.0 through 4.20.0, and per the Apache-published advisory carries partial (Low) impact to confidentiality, integrity, and availability. Tagged as an Information Disclosure issue, it is remotely reachable per the CVSS network vector and appears to let a remote attacker submit malformed input that the framework fails to properly validate, potentially exposing limited data or perturbing message processing. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Apache Camel is a widely-used Java-based enterprise integration framework implementing Enterprise Integration Patterns (EIP), routing and mediating messages between systems across hundreds of components/protocols (HTTP, JMS, file, Kafka, etc.). The root cause is CWE-20 (Improper Input Validation): the framework accepts input without adequately verifying that it conforms to expected properties before use, which for an integration engine that parses and transforms external data is a common and impactful class. The single CPE provided (cpe:2.3:a:apache_software_foundation:apache_camel) confirms the core Camel library itself is affected rather than a specific add-on, though the sparse advisory does not name the exact component or endpoint where validation fails.

RemediationAI

Vendor-released patch: upgrade to Apache Camel 4.14.8 (for the 4.14.x and earlier line), 4.18.3 (for the 4.15.0-4.18.2 line), or 4.21.0 (for the 4.19.0-4.20.0 line), matching the fixed release to your current branch as documented in the Apache advisory at https://camel.apache.org/security/CVE-2026-46587.html. Because the advisory does not disclose the vulnerable component or a configuration-level workaround, no reliable feature-toggle mitigation can be stated with confidence; as compensating controls pending upgrade, restrict network exposure of Camel routes that accept untrusted input (for example, place HTTP/consumer endpoints behind authentication or a WAF/reverse proxy and limit source IPs) and validate or sanitize inbound message payloads at the perimeter - noting these are perimeter mitigations that do not fix the underlying library and may not cover all affected code paths. Consult the vendor advisory for any component-specific guidance before relying on a workaround.